PT-2018-1900 · Php+3 · Php+3
Published
2018-04-29
·
Updated
2019-08-19
·
CVE-2018-10548
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.6.36
PHP versions 7.0.x prior to 7.0.30
PHP versions 7.1.x prior to 7.1.17
PHP versions 7.2.x prior to 7.2.5
Description
An issue in PHP allows remote LDAP servers to cause a denial of service (NULL pointer dereference and application crash) due to mishandling of the
ldap get dn return value. The vulnerability is related to the improper handling of specially crafted LDAP server responses. Exploitation of this issue may allow a remote attacker to cause a denial of service.Recommendations
For PHP versions prior to 5.6.36, update to version 5.6.36 or later.
For PHP versions 7.0.x prior to 7.0.30, update to version 7.0.30 or later.
For PHP versions 7.1.x prior to 7.1.17, update to version 7.1.17 or later.
For PHP versions 7.2.x prior to 7.2.5, update to version 7.2.5 or later.
As a temporary workaround, consider restricting access to the
ldap get dn function until a patch is available.Fix
DoS
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Php
Suse
Ubuntu